Binance has fully reimbursed clients for $6.34 billion stolen by hackers — the largest crypto incident in history is closed

Cryptocurrency exchange Binance has announced the completion of reimbursements to clients for all digital assets stolen in the largest incident of its kind in history. The company allocated over $6.34 billion of its own funds to cover the damages. The reimbursement took slightly longer than originally expected: the exchange had to purchase rare and low-liquidity tokens on the market to restore collateral in the specific cryptocurrencies affected by the attack, rather than merely providing their cash equivalent.

Three sources of compensation funding

According to the exchange, the damage coverage was provided by three sources: a portion of the reserve "Secure Asset Fund for Users" (SAFU), funds from the Futures Insurance Fund, and the corporate treasury. The missing tokens were purchased on the open market and through over-the-counter (OTC) deals. This approach allowed for the restoration of collateral in the specific cryptocurrencies affected by the attack. Binance also promised to replenish the SAFU to approximately $1 billion to maintain it as a separate reserve for user protection.

Updated reserve verification system

Simultaneously with the completion of the compensation, the exchange updated its Proof of Reserves (PoR) system. It now covers 198 tokens and allows users to independently verify the existence of reserves that match the exchange's obligations to clients. The company emphasizes that while this expands public access to reserve data, it is not an independent audit of all the company's financial liabilities.

How the hackers operated

According to Binance's internal investigation, the attackers used a fake job interview to compromise an employee's computer and an internal artificial intelligence-based tool. This gave them control over hot wallets and the ability to withdraw funds totaling $6.34 billion. The attack is linked to a hacker group reported to have connections with organizations in North Korea.

Reimbursement timeline

The attack occurred on October 29. By November 1, Binance had reimbursed 95% of the stolen tokens and began disbursing funds to clients. It took another ten days to find and purchase rare and low-liquidity assets. The exchange stated that the costs of purchasing the tokens would not be passed on to the clients. Thus, as of November 12, the largest crypto incident in history is formally closed: all stolen assets have been returned to users, and the reserve verification system has been expanded to 198 tokens.